If there is no reporting channel for cybersecurity issues for vehicles destined for Chile, pause delivery claims about connected-service support until a working intake route, named owner, response clock and escalation path have been tested. A phone number for ordinary repairs is not automatically a security-reporting channel.
This review covers vehicle functions, accounts, software and suspected product vulnerabilities. It does not determine whether a particular event triggers a statutory report, and it does not treat a supplier channel as an official public authority channel.
The reporting channel must cover different event types
The UNECE UN Regulation No. 155 page provides general background on vehicle cybersecurity management systems. It does not establish the mandatory procedure for a specific model in Chile, nor does it replace a usable incident intake route from the service provider.
Define categories for account takeover, unauthorized vehicle access, suspicious software behavior, update failure, exposed credentials and ordinary product faults. The intake form should capture the VIN, time, software version, reporter contact, observed behavior and urgency without demanding unrelated customer data.
Test the route with a tabletop exercise
Use synthetic details to submit a harmless test. Record acknowledgement time, ticket number, first responder, escalation recipient and closure message. If the mailbox rejects the message, the form has no confirmation, or staff cannot identify the owner, the channel has not passed acceptance.
Do not send real customer logs during the exercise. Diagnostic evidence should be minimized, authorized, encrypted where appropriate and transferred only after the recipient and purpose are confirmed.
Incident reporting acceptance table
| What to check | When you can proceed | When you must pause | Who is responsible |
|---|---|---|---|
| Scope and entry point | Vehicle, account, software and vulnerability reports have a documented route | Only a generic sales or repair number is available | Connected-service coordinator |
| Receipt and triage | A test produces a ticket, acknowledgement and severity owner | The reporter receives no traceable confirmation | Cybersecurity response lead |
| Data handling | Required fields, recipient, purpose and retention rule are stated | The route requests unrestricted customer logs | Data protection officer |
| Escalation and customer notice | Supplier, distributor and public-channel boundaries are documented | No role owns overdue cases or customer updates | Aftersales director |
| Customer handover material | Owners and fleet users can find the route and retain a case reference | Instructions remain unavailable to the actual user | Vehicle delivery approver |
Keep supplier and Chilean public channels distinct
Vehicle features, accounts, software and product vulnerabilities normally go first to the company providing the relevant product or service. The National Cybersecurity Agency of Chile publishes cybersecurity rules, CSIRT information and reporting resources with their own scope. A qualified local role must decide whether a specific event belongs in a statutory or public route.
An unanswered supplier ticket should move through the contracted escalation chain: service desk, technical owner, security contact and commercial owner. Preserve times and ticket references. Do not redirect every customer complaint to a government channel merely because the supplier is slow.
Give customers executable delivery instructions
The handover pack should state where to report, which details to include, what not to send, expected acknowledgement and the fallback contact. After a resale, account change or subscription change, verify that the route still works and notify delivered customers of any new address or process.
For the support evidence expected from a supplier, see the Starvia remote diagnostic support FAQ. Keep the vehicle list, channel owner and latest exercise result with the delivery record.
FAQ
Is an aftersales phone number enough as a cybersecurity intake route?
Only if trained staff can recognize security indicators, create a traceable ticket and escalate it to a named security owner. Otherwise it remains an ordinary service contact.
May a channel test include real customer logs?
No. Use synthetic information for acceptance. Real logs are sent only for a defined investigation, with minimum necessary data, authorization and an identified recipient.
What should a distributor do when the supplier never responds?
Document every attempt, invoke the contractual escalation path, protect affected accounts or functions and obtain local professional advice on any required notification. Keep customers informed within the confirmed scope.
Why route a software fault through security triage?
Many faults are ordinary reliability issues, but the first report may not reveal whether access, data or update integrity is involved. Triage separates routine repair from a potential security event without overstating the finding.
Regarding account, software-update and security-intake material in a Chilean order, use Contact Starvia or WhatsApp and provide the model, service operator and current channel description.
Produced by Starvia Automotive. This article provides general procurement guidance and is not legal, regulatory or cybersecurity incident-response advice. Requirements depend on the competent authorities in Chile, the contract, professional assessment and the actual vehicle system. Information reviewed on 2026-09-10.